If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: Session fixation when using FORM authentication (CVE-2019-17563)

  - tomcat: JsonErrorReportValve injection (CVE-2022-45143)

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is unlikely to be present in a production website.
    (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Tomcat installed on the remote host is prior to 8.5.58. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.58_security-8 advisory.

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 8.5.58-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-011 advisory.

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5360-1 advisory.

    It was discovered that Tomcat incorrectly performed input verification. A remote attacker could possibly     use this issue to intercept sensitive information. (CVE-2020-13943, CVE-2020-17527, CVE-2021-25122,     CVE-2021-30640)

    It was discovered that Tomcat did not properly deserialize untrusted data. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2020-9484, CVE-2021-33037)

    It was discovered that Tomcat did not properly validate the input length. An attacker could possibly use     this to trigger an infinite loop, resulting in a denial of service. (CVE-2021-25329, CVE-2021-41079)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.0.0.M8. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m8_security-10 advisory.

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory. 

  - Vulnerability in the Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c   and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via   multiple protocols to compromise Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite).   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   (CVE-2020-5360).

  - Vulnerability in the Workload Manager (Apache Tomcat) component of Oracle Database Server. Supported versions   that are affected are 18c and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Workload Manager (Apache Tomcat). Successful attacks of this vulnerability can   result in unauthorized access to critical data or complete access to all Workload Manager (Apache Tomcat)   accessible data (CVE-2020-17527).

  - Vulnerability in the Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) component of Oracle Database   Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability   allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Database - Enterprise   Edition (Dell BSAFE Crypto-J). Successful attacks require human interaction from a person other than the attacker.   Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to   all Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) accessible data (CVE-2019-3740). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M8. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m8_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0494 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 5.4.1 serves as a replacement for Red Hat JBoss Web Server 5.4.0,     and includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes,     linked to in the References.

    Security Fix(es):

    * tomcat: Apache Tomcat HTTP/2 Request mix-up (CVE-2020-13943)
    * tomcat: HTTP/2 request header mix-up (CVE-2020-17527)
    * tomcat: Information disclosure when using NTFS file system (CVE-2021-24122)
    * openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in information disclosure.

An update of the apache package has been released.

This update for tomcat fixes the following issues :

  - CVE-2020-13943: Fixed HTTP/2 Request mix-up     (bsc#1177582)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for tomcat fixes the following issues :

  - CVE-2020-13943: Fixed HTTP/2 Request mix-up     (bsc#1177582)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - If an HTTP/2 client connecting to Apache Tomcat     10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent     streams for a connection (in violation of the HTTP/2     protocol), it was possible that a subsequent request     made on that connection could contain HTTP headers -     including HTTP/2 pseudo headers - from a previous     request rather than the intended headers. This could     lead to users seeing responses for unexpected     resources.(CVE-2020-13943)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57. It is, therefore, affected by a vulnerability. If an HTTP/2 client exceeds the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This can lead to users seeing responses for unexpected resources.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

It was discovered that there was an issue in Apache Tomcat 8, the Java application server. An excessive number of concurrent streams could have resulted in users seeing responses for unexpected resources.

For Debian 9 'Stretch', this problem has been fixed in version 8.5.54-0+deb9u4.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 9.0.38. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.38_security-9 advisory.

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202296	RHEL 8 : tomcat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
197819	Apache Tomcat 8.5.0 < 8.5.58	Nessus	Web Servers	medium
195432	RHEL 6 : tomcat (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	critical
182014	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-011)	Nessus	Amazon Linux Local Security Checks	medium
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	critical
159385	Ubuntu 18.04 LTS / 20.04 LTS : Tomcat vulnerabilities (USN-5360-1)	Nessus	Ubuntu Local Security Checks	high
150935	Apache Tomcat 10.0.0.M1 < 10.0.0.M8	Nessus	Web Servers	medium
148894	Oracle Database Server Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	high
701332	Apache Tomcat < 10.0.0-M8 Vulnerability	Nessus Network Monitor	Web Servers	medium
146431	RHEL 7 / 8 : Red Hat JBoss Web Server 5.4.1 Security Update (Moderate) (RHSA-2021:0494)	Nessus	Red Hat Local Security Checks	high
145386	Debian DSA-4835-1 : tomcat9 - security update	Nessus	Debian Local Security Checks	high
143063	Photon OS 1.0: Apache PHSA-2020-1.0-0338	Nessus	PhotonOS Local Security Checks	medium
142985	Photon OS 2.0: Apache PHSA-2020-2.0-0295	Nessus	PhotonOS Local Security Checks	medium
142655	Photon OS 3.0: Apache PHSA-2020-3.0-0161	Nessus	PhotonOS Local Security Checks	medium
142550	openSUSE Security Update : tomcat (openSUSE-2020-1842)	Nessus	SuSE Local Security Checks	medium
142186	openSUSE Security Update : tomcat (openSUSE-2020-1799)	Nessus	SuSE Local Security Checks	medium
142170	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2020-2324)	Nessus	Huawei Local Security Checks	medium
112629	Apache Tomcat 8.5.x < 8.5.58 Information Disclosure	Web App Scanning	Component Vulnerability	medium
112628	Apache Tomcat 9.0.0.M1 < 9.0.38 Information Disclosure	Web App Scanning	Component Vulnerability	medium
112627	Apache Tomcat 10.0.0-M1 < 10.0.0-M8 Information Disclosure	Web App Scanning	Component Vulnerability	medium
141466	Debian DLA-2407-1 : tomcat8 security update	Nessus	Debian Local Security Checks	medium
141446	Apache Tomcat 9.0.0.M1 < 9.0.38	Nessus	Web Servers	medium

Detections

Analytics

CVE-2020-13943

medium

Tenable Plugins

high

medium

high

critical

medium

critical

critical

critical

high

medium

high

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium